Data Universal Limited (Office 3906, The CTR, 99 Queens Road, Hong Kong) (“we”, “us”, “our”) controls account, service, telemetry, security, suppression and marketplace-administration data for the downloadable, self-hosted business application (the “Software”) and the hosted relay service we operate, currently at relay.celerp.com (the “Relay”). Contact: legal@celerp.com, Office 3906, The CTR, 99 Queens Road, Hong Kong.
EU representative: We have appointed a representative in the European Union under GDPR Article 27. If you are in the EEA you may contact our representative on any matter relating to our processing of your personal data: Data Protection Representative Limited (trading as DataRep), a company registered in Ireland (number 616588), The Cube, Monahan Road, Cork, T12 H1XY, Ireland; digitalrequest@datarep.com; +353 (1) 919 8899.
Account information: name, email address, and billing details provided during registration or account creation.
Connector credentials: when you connect third-party platforms through the Relay, we receive and store the access credentials (such as OAuth tokens) required to operate that connection on your behalf. These credentials are encrypted at rest and used solely to perform the sync operations you initiate.
Usage and security data: API request logs, error reports, and server and security logs used to operate, secure and improve the service.
Billing data: payment is processed by Stripe. We do not store card numbers; Stripe handles all payment card data under PCI-DSS compliance.
Service analytics: when your instance of the Software is connected to the Relay, we collect operational metrics and business performance indicators from your instance, such as feature usage patterns, entity counts, and transaction volume indicators. This data is collected automatically as part of the Relay service and is associated with your account.
AI query data: if you use the Software’s AI features, your query text and relevant business context are transmitted to third-party language model providers for processing. We route queries exclusively through providers whose commercial API terms prohibit logging or training on customer data. Neither we nor our AI providers retain your query content beyond the duration of the request.
Partner and referral programme data: if you join an implementation or referral programme, we process the legal or contracting name, display name, country, account emails, programme status, agreement-acceptance evidence, referral codes and attribution, commission and payout records, and implementation-partner profile and deployment-relationship records needed to administer that programme.
Enterprise enquiries: if you ask for implementation help, we process the contact and business information you submit, including your email, country, company, stated need and any optional note, so we can route and manage the enquiry.
Migration source requests: if you submit a migration source request, we process the information you provide, including your email address, the accounting system you identify, any approximate client count, and whether you request early access. We also record limited technical and delivery information associated with the request, including the source IP address, country derived from that address, browser user agent, referring page and notification delivery status. We use this information to identify, deduplicate and administer requests, assess demand for migration sources, understand where requests come from and prevent abuse. If you request early access, we may use your email to contact you about early access to the migration source you requested. For EEA and UK users, our lawful basis for request processing, product planning and abuse prevention is Article 6(1)(f), based on our legitimate interests in developing, operating and protecting the service. Where applicable law requires consent for early-access communications, we rely on the choice you make on the form. Providing an email address is required to submit a request.
We process your email address, sign-in identifier, install binding, account status and service records to create, authenticate and provide your account and relay services. The GDPR basis is Article 6(1)(b). Providing an email address is required to create an account. Without it, no account can be created.
We process the account or install identifier already used by the service, event type and time, product and version information, and ordinary server and security logs to measure signup, activation and purchase stages, diagnose failures, improve the service and prevent abuse. The GDPR basis is Article 6(1)(f). Our interests are operating and improving the service and preventing abuse. This data is used by us and by service providers acting on our behalf to operate, secure, diagnose and improve the service. We do not sell it, disclose it for third-party advertising, or use it to make legal or similarly significant decisions about you. You may object.
We disclose personal data only to service providers used for authentication, hosting, email delivery, payment and support; to the named third-party seller when you buy its Module; to professional advisers; and to authorities where legally required. A service provider acting for us is bound to process the data only for the contracted service. In particular:
When you buy a third-party Module, we disclose your email address and purchase record to the named seller. The seller controls that data independently to fulfil, support and administer the sale. The seller’s identity, location and privacy notice are shown before purchase. We permit an EU purchase only where the transfer is covered by an adequacy decision or another valid GDPR Chapter V safeguard.
Customer ERP records and generated documents remain stored on the customer’s device. When a customer directs us to send a document email, we act as processor for the notification data the customer supplies: recipient and sender contact information, the subject and any customer-written message, the document type, number and amounts, the revocable view and payment links, and the resulting delivery metadata. The underlying document is not attached to the email and is not transmitted through our email delivery provider. We use notification data only to send, secure, troubleshoot and evidence delivery of the customer’s communication. Our email delivery subprocessor (Resend) stores the message content temporarily for delivery operations under its data processing terms; we retain delivery metadata but not the message body, and we do not record subject lines in our logs.
When a recipient opens a view or payment link, our tunnel transiently routes the request and the document response between the recipient and the customer’s installation. We do not retain a hosted copy of the document. Customers must not put special-category personal data, criminal-record data, authentication credentials or other highly sensitive information in an email subject or message; sensitive content belongs inside the customer-hosted document reached through the secure link.
We separately control the minimum account, security, abuse-prevention, suppression and legal-compliance data described in this Policy. Sending suspensions triggered by recipient spam complaints can be appealed to legal@celerp.com for human review.
We operate from Hong Kong and may use service providers in other countries. Where the law of your location restricts cross-border transfers (for example the EEA or UK GDPR Chapter V, or Thailand’s PDPA), we transfer personal data only under a safeguard recognised by that law, such as an adequacy decision or another valid transfer mechanism. The applicable safeguard or a means to obtain a copy is available from legal@celerp.com.
We retain identifiable account and telemetry data while the account is active and afterward for as long as it remains reasonably necessary for the stated analytics, security, fraud-prevention, dispute and legal purposes. When identifiable data is no longer necessary for those purposes, we delete or anonymise it. Following a valid erasure request, we erase account, telemetry and licence rows unless continued retention is permitted or required by law. We retain only the minimum suppression data needed to honour an opt-out and CLA signature records needed to prove or enforce the CLA. Connector credentials are retained while your account is active and deleted within 30 days of account termination. Billing records are retained for 7 years as required by Hong Kong tax law. We retain commercial agreement acceptances, commission and payout records, and related audit records for as long as reasonably necessary to administer, evidence or enforce the programme and to satisfy accounting, tax, fraud-prevention and legal requirements. We retain migration source requests only for as long as reasonably necessary for the purposes described in this Policy, after which we delete or anonymise them. Following a valid deletion or erasure request, we delete the relevant personal data unless continued retention is permitted or required by applicable law.
Connector credentials and secrets are encrypted at rest using industry-standard authenticated encryption. All data in transit is protected by TLS 1.2 or higher. Access to production systems is restricted to authorised personnel.
This section applies to everyone who uses the Service. The region-specific sections below give additional rights to people in the places named; each applies only if, and to the extent, its law applies to you. Everyone may unsubscribe from marketing at any time and may ask for access to or correction of personal data we hold about them, or request its deletion where applicable, by emailing legal@celerp.com or writing to Office 3906, The CTR, 99 Queens Road, Hong Kong. We respond as required by the law that applies to you.
If you are in the EEA or the UK, the lawful bases stated above apply, and you may request access, rectification, erasure, restriction, portability and objection. Your objection to our direct marketing is absolute. You may complain to a supervisory authority, including in the Member State of your habitual residence, place of work or the place of the alleged infringement. International transfers use a Chapter V safeguard as described in the International transfers section. You may reach our EU representative under GDPR Article 27, named in section 1, on any matter relating to our processing of your personal data.
If you are a California resident, you may request to know, delete and correct the personal information we hold, and you may opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under California law. We will not discriminate against you for exercising these rights.
If you reside in a US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut or Texas), you may request to access, delete and correct your personal data, opt out of targeted advertising, sale and certain profiling, and appeal a refusal of your request.
If you are in Thailand, you have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent under the Personal Data Protection Act B.E. 2562. Cross-border transfers are made under a safeguard recognised by the PDPA, and you may complain to the Personal Data Protection Committee.
If the Hong Kong PDPO applies, you have rights of access to and correction of your personal data. We use your personal data in direct marketing only after notifying you and where you have not objected, and we honour opt-outs at any time.
Wherever you live, you may have rights under your local law. Contact legal@celerp.com and we will honour them as that law requires.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects.
The Software’s web interface and our portals use cookies that are strictly necessary for authentication and security. The celerp.com marketing website uses Google Analytics subject to the consent rules described in its cookie notice.
If you follow a referral link, the Relay may use a first-party referral-attribution cookie so an eligible referrer can receive commission if you later buy a qualifying paid service. The cookie stores the referral code, not ERP content, and is retained for no longer than the referral programme attribution window, currently 90 days. Where applicable law requires prior consent for that storage, we ask before setting the referral-attribution cookie; declining referral attribution does not prevent you from using the website or buying the service. You can withdraw a previously accepted referral cookie using your browser's cookie controls. Referral attribution does not give the referrer access to your account, installation or business data.
We may update this policy from time to time. Material changes will be communicated by email or in-app notification. Continued use after the effective date constitutes acceptance.
When you connect a store or platform (such as Shopify), the data exchanged may include personal data relating to your customers, such as names, contact details, and order information. We process this data only to perform the syncs you configure and for no other purpose. It is transmitted to your self-hosted instance of the Software and is not retained on our servers. For this data you are the data controller and we act as your data processor under our Data Processing Addendum. You are responsible for responding to requests from your own customers; we assist by honouring the connected platform’s deletion and redaction requests and by deleting the connection’s stored credentials when you disconnect or uninstall.
Data Universal Limited
Office 3906, The CTR, 99 Queens Road, Hong Kong
Email: legal@celerp.com